This CL adds Babel, ForLoop, DestructuringAssignment perf tests
for object destructuring assignment.

Bug: v8:11614
Change-Id: Iab922f9d79dbb7888b6583e6bf2930e229ad6f38
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3538280Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79545}

This CL removes:

- Dynamic map checks aka minimorphic property loads (TF support,
  builtins).
- "Bailout" deopts (= drop to the interpreter once, but don't
  throw out optimized code).
- "EagerWithResume" deopts (= part of dynamic map check
  functionality, we call a builtin for the deopt check and deopt
  or resume based on the result).

Fixed: v8:12552
Change-Id: I492cf1667e0f54586690b2f72a65ea804224b840
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401585
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79544}

Reporting messages can trigger termination in case of `inspector-test`,
which we need to be able to deal with gracefully for the fuzzer.

Fixed: chromium:1307449
Change-Id: I88ba2b13d920134a1670b808adc4ace4ca6d1dff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3540260
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79543}

Adding some DCHECKs to document invariants and correctness properties
(e.g. pages with live objects aren't freed).

Bug: v8:12612
Change-Id: I543e4846c791320f3965561ae9d0b54739f5df03
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3507993Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79542}

Bug: v8:10009
Change-Id: I1f71b2783cd07331a65f46c316e87a46396e7eda
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3516153Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79541}

- Avoid redrawing property-link tables if the contents don't change
- Don't update timeline legends if the selection doesn't change
- Use shorter class names for the flamechart for faster parsing
- Round positions in flamechart to avoid long strings that would be
  created from raw double positions
- Don't redraw the tooltip if the content is the same

Change-Id: I925f1708400286c7c9f8db62f75c3b5fe8a16b12
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3521945Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79540}

This implements the last bits of basic concurrent Maglev compilation.
When jobs have been processed, schedule an interrupt to trigger codegen
and building the Code object on the main thread.

Changed since the initial version:
- Put the include behind V8_ENABLE_MAGLEV.
- Skip 18.js until we have deterministic test helpers for concurrent
  tiering.

Bug: v8:7700
Change-Id: Ibc103f097fe00f7df93a33a785939e43901f3734
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3536662Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79539}

Bug: chromium:1307610
Change-Id: I60aaa0e58e13b705b5eff4b57411a0ad4a2e9b3f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534849Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79538}

Avoid instruction selector to emit sign extension instruction after most
`xxx.w` instructions in RV64I and RV64M, because `xxx.w` instructions
will automatically sign-extend the result

Change-Id: Ia4291242dc3e51f49be1e6dda2d5a3365b5e7bfa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3536845Reviewed-by: Yahan Lu <yahan@iscas.ac.cn>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#79537}

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/ea8c08d..a9359a8

Move back to single android icu data file. (Mohamed Heikal)
https://chromium.googlesource.com/chromium/deps/icu/+/a9359a8

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,ftang@chromium.org

Change-Id: I14c6e7b436a98555a4e1ba9e8a0958aaa0d43d57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3538221
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79536}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/a480a08..60b16f1

Promote inclusive language. (#1360) (Brad Messer)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/60b16f1

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: Ic01a08e37caf270d99e3898c8a83b72f56c6ddbc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3538220
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79535}

Also add AO: ToTemporalInstant, ParseTemporalInstant,
ParseTemporalInstantString,

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.instant.from
https://tc39.es/proposal-temporal/#sec-temporal-totemporalinstant
https://tc39.es/proposal-temporal/#sec-temporal-parsetemporalinstant
https://tc39.es/proposal-temporal/#sec-temporal-parsetemporalinstantstring

Bug: v8:11544
Change-Id: Ie78f7389eef15795f276291ba99e18a72566f9bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3382056Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79534}

Will re-enable once a few issues have been resolved.

Change-Id: Ieed60efcb6d59cc5ca10931913dd4d9ffea8b9f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532202Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#79533}

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.instant.fromepochseconds
https://tc39.es/proposal-temporal/#sec-temporal.instant.fromepochmilliseconds
https://tc39.es/proposal-temporal/#sec-temporal.instant.fromepochmicroseconds
https://tc39.es/proposal-temporal/#sec-temporal.instant.fromepochnanoseconds

Bug: v8:11544
Change-Id: I254ef66faf5e6a49bfc389f2952ffab3d5c0bed2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3382054
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79532}

Bug: v8:11525
Change-Id: I74190f2136e91107deea2c31f750a2d1a43dc18a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3528502Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79531}

Fixes bazel bot issue:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20bazel%20-%20builder/1279/overview

Bug: v8:7700
Change-Id: I4a7b43517574fc99bed2fe2bd75c126d06fcfad8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3535790
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79530}

No-Try: True
Change-Id: I14986d7eb1e24faef2d6d4f1decde613b2454f1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3535788Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79529}

This is a reland of 48b443f6.

While fixing the initial CL, we stumbled upon a few bugs that
we had to fix:

 - CommonOperatorReducer and SimplifiedOperatorReducer were applied
   before and after SimplifiedLowering, but always assumed that it
   was before SimplifiedLowering, and thus had the wrong semantics
   for branches in some cases. They now have an added parameter to
   know which semantics of branch they should use.

 - The lowering of StaticAssert was wrong and could leave kHeapConstant
   in the assert (instead of machine Booleans).

Original change's description:
> [compiler] Simplify "==0" branches in MachineOperatorReducer
>
> Bug: v8:12484
> Change-Id: I0667c7464c0dd71338bc199a24a69248a7a0a525
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3497303
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Owners-Override: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79379}

Bug: v8:12484
Change-Id: Ibbf5df96fce5ccb04868dc517539479bf69f5703
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3516869Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79528}

This reverts commit cf25b3bc.

Reason for revert: https://crbug.com/1307471. TraceTrait must only be used during marking.

Original change's description:
> cppgc: Rework prefinalizers
>
> Move the check for whether an object is live or dead out of the
> prefinalizer trampoline. Moving it into the backend allows for
> inlining the check which avoids a call to the trampoline for live
> objects.
>
> On catapult benchmarks (e.g. cnn:2021, nytimes:2020), there's often
> ~2k finalizers registered. In order to avoid memory overhead in the
> range of a few KB, we store the fact whether the object points to the
> base object payload in the LSB of the pointer. For caged builds this
> is replaced with just storing the index into the cage for both object
> and base object payload.
>
> Locally saves around ~10% of atomic sweeping processing time which is
> in the order of .05ms.
>
> Bug: v8:12698
> Change-Id: I198205a6b1d57fc2df821ee4e73e53dc6f825ff5
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3497764
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79442}

Bug: v8:12698, chromium:1307471
Change-Id: I5c4e70d46cb99af66c77f0c013625b6af6c6eb8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3535781
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79527}

Bug: chromium:1304658

Change-Id: I6a82603a7c5de5ae8f5a895990c1a904bbdd39b2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532263
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79526}

There are problems calling WaitForRunningWorkers when we
call quit().
First, suppose the main thread first calls quit(),
and the worker thread calls quit() after the main
thread calls quit(), then sched_yield to wait for
quit_once_ updated to ONCE_STATE_DONE. However
the main thread is WaitForRunningWorkers to wait
for the worker thread to join, thus causing deadlock.

Second, suppose the worker thread calls quit() and empty
the running_workers_ by WaitForRunningWorkers, then
the main thread calls `onExit(isolate, true)` to dispose
the platform and other global data, which will crash other
running workers.

Bug: v8:12219
Change-Id: I333e5aad431daefb1c163f69e66d8e9d5e9bf754
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3518908Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79525}

This reverts commit f198f35d.

Reason for revert: Got enough fuzzer bugs to work on

Original change's description:
> [rab/gsab] Temporarily stage --harmony-rab-gsab to enable fuzzing
>
> Please revert this CL if it causes any trouble!
>
> Bug: v8:11111
> Change-Id: I6061fdc0aed82952f093ede9ecd252be1ac99519
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3528495
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79499}

Bug: v8:11111
Change-Id: I9eef57eeba72116cc97c347abe2b56277855b797
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3535779
Commit-Queue: Marja Hölttä <marja@chromium.org>
Auto-Submit: Marja Hölttä <marja@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79524}

Bug: v8:11544
Change-Id: I134b8c786a8dfaef2f4f2509ec5f6c6a009852f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3379232Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79523}

Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/8a5b728..ea8c08d

Fix android filter by changing filter type (Frank Tang)
https://chromium.googlesource.com/chromium/deps/icu/+/ea8c08d

Add "-Wno-deprecated-pragma" (Mark Schott)
https://chromium.googlesource.com/chromium/deps/icu/+/11138de

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,ftang@chromium.org

Change-Id: I86b0e16691dedd48e35c4aa79fee5feeb7701329
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534847
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79522}

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/5704cd4..a480a08

[nfc] Reformat doc-string in generate_export_header (#1376) (Vy Nguyen)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/a480a08

Fix Bazel build breakage caused by commit 6a894bd. (#1374) (Paul Wankadia)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/808571a

Build `//:benchmark` as a static library only. (#1373) (Paul Wankadia)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/6a894bd

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: Ic2015e271f35597f3b78de84fbe88e5ae1f02d79
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534848
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79521}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/3d95907..3444906

Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/113dd1b..d8c3754

Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/a897d0f..93b8dcd

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/b3fe2c1..389f33b

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/b199f54..76979da

Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/ae5e06d..b007c54

Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/b0676a1..923f5eb

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/b60d34c..a15c2df

R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ifd7ec0fcb5f51d4fb1560ba5ff7e7db544348ad1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534846
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79520}

Bug: v8:12717
Change-Id: I0ffe277dda3eed2073f166f2b93a2f2c611c6d01
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532232Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79519}

Bug: v8:12697
Change-Id: I124f2f0fd3c98d6a5233a0e2a8236a2b15d791fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532261
Auto-Submit: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79518}

This reverts commit 406bcd69.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64/46797/overview

Original change's description:
> [maglev] Finish & enable basic Maglev concurrent tierups
>
> This implements the last bits of basic concurrent Maglev compilation.
> When jobs have been processed, schedule an interrupt to trigger codegen
> and building the Code object on the main thread.
>
> Bug: v8:7700
> Change-Id: I348ade4777ddddf7c3a6b0575d9f51e5fa00c9fb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3528494
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79516}

Bug: v8:7700
Change-Id: I1faa092b96e56149b4db2e271680f39c7af61554
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532231
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79517}

This implements the last bits of basic concurrent Maglev compilation.
When jobs have been processed, schedule an interrupt to trigger codegen
and building the Code object on the main thread.

Bug: v8:7700
Change-Id: I348ade4777ddddf7c3a6b0575d9f51e5fa00c9fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3528494Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79516}

.. into new virtual subclass TurbofanCompilationJob. Update all TF code
to derive from this class. Specifically, the OptimizedCompilationInfo is
TF-specific and now lives in TurbofanCompilationJob.

The motivation behind this is that Maglev now also uses this
infrastructure.

Drive-by: Replace CompilationMode with ConcurrencyMode.

Bug: v8:7700
Change-Id: Iae6d1ffd1c810e2e45cad6c9b4e43d4c82ac54a7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3528493Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79515}

In JSCallReducer::ReduceArrayPrototypeShift, add Unsigned32
TypeGuard for index Node used in fast path, avoid representing
kRepFloat64 (Range(1, inf)) to kRepWord64 when converting
input for kLoadElement.

Bug: v8:12632
Change-Id: I2e4b00840dc5462e4351e13a372c33b6272b9ea1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3528373Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79514}

Fixes wrong conditional logic in BaselineCompilerTask::Install.
Removes is_compiled(), since CanCompileWithBaseline already
checks for HasBytecodeArray.

Bug: chromium:1307072
Change-Id: I4cc61e2bab8d1fb5a5b253d291c7079b82c3fa44
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532230
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79513}

This started out as a minor code move of early-osr logic, but
became a more general refactor of the tiering decisions.

Early-OSR: the intent here is to trigger OSR as soon as possible
when matching OSR'd code is cached. Move this out of ShouldOptimize
(since it has side effects), and into a dedicated function that's
called early in the decision process.

Note that with this change, we no longer trigger normal TF optimization
along with the OSR request - TF tiering heuristics are already complex
enough, let's not add yet another special case right now.

Other refactors:

- Clarify terminology around OSR. None of the functions in TM actually
  perform OSR; instead, they only increase the OSR urgency, effectively
  increasing the set of loops that will trigger OSR compilation.
- Clarify the control flow through the tiering decisions. Notably,
  we only increment OSR urgency when normal tierup has previously been
  requested. Also, there is a bytecode size limit involved. These
  conditions were previously hidden inside other functions.

Bug: v8:12161
Change-Id: I8f58b4332bd9851c6b299655ce840555fb7efa92
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3529448Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79512}

This reverts commit 9f9f36f8.

Reason for revert: regressed ai-astar on the M1

Original change's description:
> [call reducer] inline Array.prototype.indexOf/includes in js-call-reducer.
>
> - inline Array.prototype.indexOf in js-call-reducer
> - inline Array.prototype.includes in js-call-reducer
>
> Bug: v8:12390
> Change-Id: Idb5669da3019f0f56af0084fccd1d616d4c5098e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3473994
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79461}

Bug: v8:12390, chromium:1306250
Change-Id: I91c666c2f56c30db4f43bb009ee6206ad219f51a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532399
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79511}

Change-Id: I3485e5d41cbafae1318c285bf564bc7df4a8c0f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532189Reviewed-by: Lutz Vahl <vahl@chromium.org>
Commit-Queue: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79510}

- Restructure the runtime function implementation.
- Rename osr_loop_nesting_level to osr_urgency and add helpers.

The motivation for the latter: I've always struggled with the
`osr_loop_nesting_level` term; it neither matches terminology of
what it's compared against (= the loop depth), nor implies what it's
used for (= osr is triggered when `loop depth < osr nesting level`).

In this CL it's renamed to `osr_urgency` to reflect that as urgency
rises, we consider more and more loops as OSR candidates.

Bug: v8:12161
Change-Id: I194ec5a3f1f02526641af1c7796ee0956b6fd3a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3528735Reviewed-by: Patrick Thier <pthier@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79509}

This reverts commit 1289704a.

Reason for revert:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Mac%20-%20arm64%20-%20release/8735/overview

Original change's description:
> [tools] Clean up py2 code
>
> Bug: chromium:1292013
> Change-Id: Ic2c3a197005a2136bb0eda4cbb36d8eb57f42a7c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3523047
> Reviewed-by: Liviu Rau <liviurau@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79507}

Bug: chromium:1292013
Change-Id: I48c38209220b775d0caa45f487ed163f78333e0c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532228
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79508}

Bug: chromium:1292013
Change-Id: Ic2c3a197005a2136bb0eda4cbb36d8eb57f42a7c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3523047Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79507}

Bug: chromium:1292013
Change-Id: If50c18249afe8b75154d4b111485280d158a5582
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3525137Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79506}